System and method to detect malicious activity through detecting anomalies in sinkholed traffic

An automated system for detecting anomalous activity in a private computer network, the system comprising:

• a detection circuit;
• and
• a non-transitory storage device storing instructions thereon that, when executed by the detection circuit, cause the detection circuit to:
• collect, over a current time period at an ingesting network device of the private computer network, non-routable network packets routed to the ingesting network device from one or more other network devices of the private computer network;
• parse the current collected network packets into corresponding current network flow records each including a source field and a destination field, the source field identifying a source node within the private computer network, the destination field representing a non-routable network address;
• and
• for each distinct source identified in the source fields of the current network flow records:
• aggregate the current network flow records of the respective distinct source into a current aggregated flow record,
• wherein the current aggregated flow record of each source comprises a list of destination IP addresses, and
• wherein the list of destination IP addresses includes external destination IP addresses whose respective IP addresses are external to the private computer network;
• enrich each distinct source identified in the source fields of the current network flow records with the external destination IP addresses of the current aggregated flow record of each distinct source to include additional information about the external destination IP addresses,
• wherein the additional information about the external destination IP addresses is not part of the current network flow records of each respective distinct source;
• analyze the current aggregated flow record using an anomaly detection module trained through machine learning on previous aggregated flow records of the respective distinct source from previous time periods in order to detect anomalous activity in the respective distinct source;
• and
• act in response to detecting the anomalous activity in the respective distinct source.

A non-transitory computer readable medium (CRM) having computer instructions stored therein that, when executed by a processing circuit, cause the processing circuit to carry out an automated process of detecting anomalous activity in a private computer network, the process comprising:

• collecting, over a current time period at an ingesting network device of the private computer network, non-routable network packets routed to the ingesting network device from one or more other network devices of the private computer network;
• parsing the current collected network packets into corresponding current network flow records each including a source field and a destination field, the source field identifying a source node within the private computer network, the destination field representing a non-routable network address;
• and
• for each distinct source identified in the source fields of the current network flow records:
• aggregating the current network flow records of the respective distinct source into a current aggregated flow record,
• wherein the current aggregated flow record of each source comprises a list of destination IP addresses, and
• wherein the list of destination IP addresses includes external destination IP addresses whose respective IP addresses are external to the private computer network;
• enriching, for each distinct source identified in the source fields of the current network flow records, the external destination IP addresses of the current aggregated flow record of each distinct source to include additional information about the external destination IP addresses,
• wherein the additional information about the external destination IP addresses is not part of the current network flow records of each respective distinct source;
• analyzing the current aggregated flow record using an anomaly detection module trained through machine learning on previous aggregated flow records of the respective distinct source from previous time periods in order to detect anomalous activity in the respective distinct source;
• and
• acting in response to detecting the anomalous activity in the respective distinct source.